KyoRox CONTROL PLANE
Gateway: Live View Plans
🏠 Home 📘 Developer Docs 💎 Pricing Plans ✉️ Contact Support
Zero-PII Stateless Control Plane

Universal SAML 2.0 to JWT Identity Proxy

Authenticate with your Tenant UUID and Live API Key to configure Okta, Microsoft Entra ID, Google Workspace, OneLogin, or Custom SAML 2.0 connections in under 5 minutes.

01
Constant-Time SHA-256 API Key Verification Authenticates against GET /api/v1/tenants/:id/connections
02
FIPS-197 AES-256-GCM Secret Vault X.509 certificates & 256-bit HS256 secrets encrypted at rest
03
Volatile RAM Execution (<15ms) 0 bytes of employee NameID or SAML attributes stored on disk
✓ Okta Workforce ✓ Microsoft Entra ID ✓ Google Workspace ✓ OneLogin & Ping
FIPS-197 AES-256-GCM IdP X.509 certs & JWT secrets encrypted at rest
Tab-Scoped Custody Credentials live strictly in volatile sessionStorage
30/14/7-Day Cert Radar Automated pre-expiry X.509 renewal alerts
Zero Per-User Tax Unlimited monthly active SSO logins on all plans
SHA-256 & ANTI-IDOR PROTECTED

Sign In to Workspace

Enter the Tenant UUID and Live API Key dispatched to your verified owner email.

Lost your Tenant ID or API Key?
VIEW 01 • COMMAND CENTER

Workspace Overview & Telemetry

New Cryptographic Credentials Generated — Copy Immediately Your previous API Key and HS256 JWT Secret have been permanently revoked. Update your backend environment variables now.
New Live API Key
—
New HS256 JWT Client Secret
—
Workspace Identity ACTIVE
Enterprise SSO Workspace
STARTER PLAN ($39/MO)
Monthly SSO Logins Unlimited (Zero Tax)
IdP Connection Quota
0 / 1 Used
1 connection slot available.
X.509 Certificate Radar 30/14/7d Scanner

No X.509 certificates pinned yet. Configure your first corporate IdP in Add IdP Studio.

Vault Encryption AES-256-GCM

Enterprise SAML 2.0 Integration Checklist

Follow these three steps to onboard any corporate customer (Okta, Microsoft Entra ID, Google Workspace, OneLogin, Ping).

STEP 01 • SP TRUST
Share Your KyoRox SP Metadata

Send your tenant Entity ID and ACS URL (or XML file) to your customer's IT administrator.

STEP 02 • PIN IDP
Step 3: Pin Buyer's IdP SSO URL & X.509 Certificate

Paste your customer's IdP Metadata XML or X.509 PEM certificate and whitelist your HTTPS callback URL.

STEP 03 • VERIFY JWT
Verify Signed HS256 JWT in Your App

Use your 256-bit Client Secret to verify the stateless JWT delivered to your callback URI.

Configured Corporate Identity Providers

Inspect pinned X.509 signing certificates, whitelisted HTTPS callback URLs, and manage active SAML 2.0 connections.

No Corporate Identity Providers Configured Yet

Configure Okta, Microsoft Entra ID, Google Workspace, OneLogin, PingIdentity, or any Custom SAML 2.0 Identity Provider in under 60 seconds.

AES-256-GCM CERTIFICATE PINNING

Configure or Update Corporate Identity Provider

Select your enterprise customer's Identity Provider below, or auto-fill all fields instantaneously from their SAML 2.0 Metadata XML.

Smart IdP Metadata XML Auto-Extractor (Optional Time-Saver) Upload your customer's IdP metadata `.xml` file or paste raw XML to auto-populate Entity ID, SSO URL, and X.509 Certificate in browser RAM.
Tip: Re-submitting an existing provider atomically rotates its X.509 certificate without consuming an extra quota slot.
OASIS SAML 2.0 SERVICE PROVIDER TRUST

Your KyoRox SAML 2.0 Service Provider (SP) Endpoints

Copy these tenant-isolated URLs into your enterprise buyer's Okta, Microsoft Entra ID, Google Workspace, or OneLogin admin console.

Open Raw XML ↗
NAMEID FORMAT: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
KyoRox enforces strict RSA-SHA256 XML Signature verification, XSW node pinning, and 300-second AssertionID anti-replay locking.
WantAssertionsSigned="true"

Select your target Identity Provider and enter your whitelisted HTTPS Callback URI to generate your complete SP-Initiated Login URL.

FIPS-197 AES-256-GCM CUSTODY

Workspace Cryptographic Vault

Use your 256-bit HS256 JWT Client Secret in your backend application to verify stateless identity tokens issued by sso.kyorox.com.

SHA-256 + AES-256-GCM
BOUND-EMAIL 6-DIGIT OTP PROTECTION

Emergency Atomic API Key & JWT Secret Rotation

Suspect a leaked environment variable? Atomically revoke your current Live API Key and 256-bit HS256 JWT Secret and issue fresh credentials.

Step 1: Dispatch 6-Digit Security Code to Bound Owner Email For zero-trust protection, key rotation requires a 6-digit OTP sent exclusively to the verified owner email bound to this tenant.
SP-INITIATED SAML 2.0 HANDSHAKE TESTER

Live End-to-End SAML 2.0 to JWT Flow Launcher

Select a configured corporate Identity Provider and whitelisted callback URL to launch a real SP-Initiated SAML AuthnRequest in a new tab.

Launch Live SSO Test ↗
DROP-IN BACKEND VERIFICATION

Verify Signed HS256 JWT in Your Application

After KyoRox verifies the corporate IdP's RSA-SHA256 XML assertion in RAM, it redirects the user to your callback URL with `?token=<HS256_JWT>`.

verify-kyorox-sso.js 

          

        


        
        

          

            

              100% IN-BROWSER RAM DECODER
              
Stateless JWT Claims Inspector

              
Paste any KyoRox `?token=eyJ...` JWT string below to inspect its decoded Header, Payload (`sub`, `email`, `idp`, `iss`, `exp`), and TTL right in your browser.

            

          


          

            
            
          


          

            

              
Decoded JWT Header

              
{
  "alg": "HS256",
  "typ": "JWT"
}

            

            

              
Decoded JWT Claims Payload

              
Paste a token above to inspect claims...

            

          

        

      


      
      

        


        

          

            

              ZERO PER-USER SSO TAX • UNLIMITED LOGINS
              
Enterprise Subscription Tiers & Connection Quotas

              
Every KyoRox plan includes unlimited monthly active users (MAU), unlimited SAML logins, FIPS-197 AES-256-GCM vault encryption, and zero PII persistence.

            

          


          

            
            

              

                
STARTER PLAN

                
$39/month USD

                
Ideal for SaaS teams onboarding their first enterprise SAML 2.0 buyer.

                
    
                  
  • ✓ 1 Active Corporate SAML 2.0 IdP
    • 
                  
  • ✓ Unlimited Monthly SSO Logins & Users
    • 
                  
  • ✓ Okta, Entra ID, Google Workspace, Custom
    • 
                  
  • ✓ AES-256-GCM X.509 & JWT Vault
    • 
                

              

              
            


            
            

              

                

                  GROWTH MULTI-TENANT
                  Most Popular
                

                
$139/month USD

                
Built for growing B2B platforms managing multiple enterprise customers.

                
    
                  
  • ✓ Up to 5 Active Corporate SAML 2.0 IdPs
    • 
                  
  • ✓ Unlimited Monthly SSO Logins & Users
    • 
                  
  • ✓ 30 / 14 / 7-Day X.509 Cert Expiry Radar
    • 
                  
  • ✓ Automated Pre-Expiry Renewal Alerts
    • 
                

              

              
            


            
            

              

                
ENTERPRISE SCALE

                
$349/month USD

                
High-capacity SAML proxy infrastructure for multi-tenant B2B leaders.

                
    
                  
  • ✓ Up to 999 Active Corporate SAML 2.0 IdPs
    • 
                  
  • ✓ Unlimited Monthly SSO Logins & Users
    • 
                  
  • ✓ 30 / 14 / 7-Day X.509 Cert Expiry Radar
    • 
                  
  • ✓ 99.9% Uptime SLA & Priority Engineering
    •